Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-35653In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted PyPI · pillow · fixed in 8.1.0
- CVE-2021-21241CSRF can expose users authentication token in Flask-Security-TooPyPI · flask-security-too · fixed in 3.4.5
- CVE-2020-25659python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 PyPI · cryptography · fixed in 3.2.1, 3.2
- CVE-2020-13922Apache DolphinScheduler (incubating) Permission vulnerabilityPyPI · apache-dolphinscheduler
- CVE-2021-3116before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data bePyPI · proxy-py · fixed in 2.3.1
- CVE-2020-28468Improper Control of Generation of Code ('Code Injection')PyPI · pwntools · fixed in 4.3.1
- CVE-2021-21236Regular Expression Denial of Service in CairoSVGPyPI · cairosvg · fixed in 2.5.1
- CVE-2020-26759clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via PyPI · clickhouse-driver · fixed in 0.1.5
- CVE-2020-28736Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therePyPI · plone, plone-app-dexterity +3 · fixed in 5.2.3, 2.6.8, 3.2.10 and more
- CVE-2020-28735Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).PyPI · plone, plone-app-dexterity +3 · fixed in 5.2.3, 2.6.8, 3.2.10 and more
- CVE-2020-28734Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.PyPI · plone, plone-app-dexterity +3 · fixed in 5.2.3, 2.6.8, 3.2.10 and more
- CVE-2020-35678Autobahn|Python before 20.12.3 allows redirect header injection.PyPI · autobahn · fixed in 20.12.3
- CVE-2020-11093Authorization bypass in Hyperledger IndyPyPI · indy-node · fixed in 1.12.4
- CVE-2020-26275Open redirect vulnerabilityPyPI · jupyter-server · fixed in 1.1.1
- CVE-2020-26263RSA vulnerability in tslite-ngPyPI · tlslite-ng · fixed in 0.7.6
- CVE-2020-17526Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on siPyPI · apache-airflow · fixed in 1.10.14
- CVE-2020-26280XSS in OpenSlidesPyPI · openslides · fixed in 3.3
- CVE-2020-22083jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function.PyPI · jsonpickle · fixed in 1.4.2
- CVE-2020-17511In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in AirPyPI · apache-airflow · fixed in 1.10.13
- CVE-2020-17513In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.PyPI · apache-airflow · fixed in 1.10.13
- CVE-2020-17515The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.PyPI · apache-airflow · fixed in 1.10.13, 1.10.15rc1, 2.0.2rc1
- CVE-2020-26266Uninitialized memory access in Eigen types in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.5, 2.0.4, 2.1.3 and more
- CVE-2020-26267Lack of validation in data format attributes in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.5, 2.0.4, 2.1.3 and more
- CVE-2020-26268Write to immutable memory region in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.5, 2.0.4, 2.1.3 and more
- CVE-2020-26269Heap out of bounds read in filesystem glob matching in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.0
- CVE-2020-26270CHECK-fail in LSTM with zero-length input in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.5, 2.0.4, 2.1.3 and more
- CVE-2020-26271Heap out of bounds access in MakeEdge in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.5, 2.0.4, 2.1.3 and more
- CVE-2020-26257Denial of service attack via incorrect parameters to federation APIsPyPI · matrix-synapse · fixed in 1.23.1
- CVE-2020-26261user-readable api tokens in systemd unitsPyPI · jupyterhub-systemdspawner · fixed in 0.15.0
- CVE-2020-29651A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to PyPI · py · fixed in 1.10.0